US11528604B2 - Method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, corresponding security element, physical or virtual element and terminal cooperating with this security element - Google Patents

Method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, corresponding security element, physical or virtual element and terminal cooperating with this security element Download PDF

Info

Publication number
US11528604B2
US11528604B2 US16/753,465 US201816753465A US11528604B2 US 11528604 B2 US11528604 B2 US 11528604B2 US 201816753465 A US201816753465 A US 201816753465A US 11528604 B2 US11528604 B2 US 11528604B2
Authority
US
United States
Prior art keywords
encrypted
security element
identifier
terminal
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US16/753,465
Other languages
English (en)
Other versions
US20200260273A1 (en
Inventor
Paul Bradley
Mireille Pauliac
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Thales DIS France SAS
Original Assignee
Thales DIS France SAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Thales DIS France SAS filed Critical Thales DIS France SAS
Publication of US20200260273A1 publication Critical patent/US20200260273A1/en
Assigned to THALES DIS FRANCE SA reassignment THALES DIS FRANCE SA CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: GEMALTO SA
Assigned to THALES DIS FRANCE SA reassignment THALES DIS FRANCE SA ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: PAULIAC, MIREILLE
Assigned to GEMALTO SA reassignment GEMALTO SA ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BRADLEY, PAUL
Assigned to THALES DIS FRANCE SAS reassignment THALES DIS FRANCE SAS ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: THALES DIS FRANCE SA
Application granted granted Critical
Publication of US11528604B2 publication Critical patent/US11528604B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices

Definitions

  • the domain of the invention is that of telecommunications and especially 5G devices (including IoT) and the identification of such devices communicating with security elements, embedded or not in these devices.
  • UICCs Universal Integrated Circuit Cards
  • eUICCs embedded UICCs
  • iUICCs integrated UICCs
  • the terminals are typically mobile phones, smartphones or tablets and IoT devices (for 2G, 3G, 4G and 5G telecommunication networks).
  • a mobile terminal When a mobile terminal tries to attach to a network for the first time (for example after a power on of the terminal), it transmits a unique identifier of the subscriber stored in the security element, known as an IMSI (International Mobile Subscriber Identifier) to the telecommunication network.
  • the IMSI is transmitted in a NAS message in clear. It is known that the transmission in clear (without ciphering of the IMSI) constitutes a security problem since the IMSI can be intercepted by a so called IMSI-catcher.
  • An IMSI-catcher is a telephone eavesdropping device used for intercepting mobile phone traffic and tracking location data of mobile phone users.
  • a “fake” mobile tower acting between the target mobile phone and the service provider's real towers BTS—Base transceiver station
  • BTS Base transceiver station
  • the IMSI can be subsequently used to send targeted messages to the mobile device subscriber (SMS spam).
  • SMS spam mobile device subscriber
  • 3G and 4G (LTE—Long Term Evolution) wireless standards mitigates some risk due to mutual authentication required from both the terminal and the network.
  • sophisticated attacks may be able to downgrade 3G and LTE to 2G network services which do not require mutual authentication.
  • the transmission in clear of the IMSI constitutes therefore a threat.
  • the unique identifier of a subscription stored in the security element (that can be a UICC, a eUICC or a iUICC) must be transmitted encrypted when required by national regulation or chosen by the operator.
  • This unique identifier can be the IMSI of the subscription stored in the security element or another identifier permitting to uniquely identify the security element or the terminal with which it cooperates.
  • a SUPI Subscribescription Permanent Identifier
  • an encrypted SUPI is part of privacy preserving identifier called a SUCI (Subscription Concealed Identifier).
  • the SUPI can also be a NAI (Network Access Identifier).
  • the SUCI is transmitted to the network with a parameter allowing an element of the network (typically a HSS—Home Subscriber Server for 3G and 4G networks or an AUSF—Authentication Server Function for 5G networks) to decrypt the SUCI for retrieving the SUPI.
  • a HSS Home Subscriber Server for 3G and 4G networks
  • AUSF Authentication Server Function for 5G networks
  • a SUCI is equal to:
  • the Network ID is the MCC/MNC (Mobile Country Code and Mobile Network Code—these are not encrypted) and the MSIN (Mobile Station Identification Number) is the rest of the IMSI (the IMSI being constituted by the MCC/MNC/MSIN).
  • the existing solution proposes to calculate the SUCI when this one has to be transmitted to the network (more precisely when the terminal cooperating with the security element is asking for a SUCI from this security element).
  • the main problem is that such a calculation takes time (approximatively 150 ms) and this delays the transmission of the SUCI to the network.
  • This is mostly problematic for IoT devices because most of them have to be able to transmit information to the network in a very short time frame (for example an IoT device integrated in a vehicle and detecting that the vehicle had just an accident—if the IoT device does not send an alert message in a very short time frame, it can be destroyed by the accident and the network operator or the rescues will never be aware that an accident occurred).
  • the calculation time is to be as short as possible for all so called mission critical devices, for example for V2X devices (vehicle-to-everything), where X can be equal to I (Infrastructure), V (Vehicle) or P (Pedestrian).
  • V2X devices vehicle-to-everything
  • X can be equal to I (Infrastructure), V (Vehicle) or P (Pedestrian).
  • the present invention proposes a solution to this problem.
  • the invention proposes a method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, or an encrypted identifier of the security element or an encrypted identifier of a terminal cooperating with the security element, the method consisting in pre-calculating proactively at the occurrence of an event the encrypted identifier using a key and storing it in a file or memory of the security element with a parameter enabling the key to be calculated by the element of the telecommunications network in order to be able to transmit to this element of the telecommunications network the encrypted identifier and the parameter, without having to compute the encrypted identifier when the terminal is asking for it.
  • the identifier is encrypted using an ECIES encryption scheme.
  • the security element is preferably a UICC, a eUICC, an iUICC or a hardware mediated execution environment.
  • the encrypted identifier is pre-calculated during one of the following events:
  • the first encrypted identifier to be used is stored in the security element in a personalization factory.
  • more than one encrypted identifiers are pre-calculated and stored with corresponding parameters in the file or memory.
  • the invention also concerns a security element comprising a processing circuit for pre-calculating an encrypted subscription identifier stored in the security element or an encrypted identifier of the security element or an encrypted identifier of a terminal designed to cooperate with the security element, the encrypted identifier being pre-calculated proactively at the occurrence of an event using a key and stored in a file or memory of the security element with a parameter enabling the key to be calculated by a physical or virtual element of the telecommunications network in order to be able to transmit to the element of the telecommunications network the encrypted identifier and the parameter, without having to compute the encrypted identifier when the terminal is asking for it.
  • the identifier is preferably encrypted using an ECIES encryption scheme.
  • the security element is preferably a UICC, a eUICC, an iUICC or a hardware mediated execution environment.
  • the processing circuit pre-calculates the encrypted identifier during one of the following events:
  • the processing circuit pre-calculates preferably more than one encrypted identifiers and stores them with corresponding parameters in the file or memory.
  • the invention also concerns a physical or virtual element of a telecommunications network comprising processing circuits for receiving from a security element an identifier encrypted by a key pre-calculated by the security element and stored in a file or memory of the security element with a parameter enabling the key to be calculated by the element of the telecommunications network.
  • This physical or virtual element is preferably constituted by a HSS or by an AUSF.
  • the invention concerns a terminal cooperating with such a security element and it is preferably constituted by a V2X terminal.
  • FIG. 1 the principle of the invention
  • FIG. 2 an example of encryption of the SUPI
  • FIG. 3 an example of decryption of the SUPI encrypted according to FIG. 2 .
  • FIG. 1 represents the principle of the invention.
  • a user equipment 10 and a network element 11 , typically a HSS (Home Subscriber Server) for 3G and 4G or an AUSF (Authentication Server Function) for 5G.
  • An AUSF is equivalent to a HSS for 5G networks.
  • the user equipment 10 is constituted by a terminal 12 (like a mobile equipment ME) cooperating with a security element 13 , here constituted by a UICC. It could also be, like foresaid, a eUICC or an iUICC.
  • the security element 13 could also be a hardware mediated execution environment such as an ARM TrustZone or Intel SGX (a secured zone in a processor).
  • the identifier of the security element 13 (the SUPI—being for example the IMSI stored in the security element) is encrypted before being needed to be transmitted (in encrypted form: the SUCI) to the network element 11 .
  • the SUPI being for example the IMSI stored in the security element
  • the SUCI is already existing and stored in a dedicated tamper resistant zone of the security element, like for example a file or a memory of the security element 13 , for example in the elementary file EF of the security element 13 , with a parameter enabling the element 11 to calculate the key with which the SUPI has been encrypted (in order to be able to retrieve the SUPI).
  • the SUCI as shown by reference 14 , is here a SUCI_ 1 and the parameter is Param_ 1 . They are here concatenated as shown by the symbol II.
  • the element 11 When the ME sends to the element 11 a registration request message (step 15 ), the element 11 answers (step 16 ) to the terminal 12 with an Identity Request message.
  • the terminal 12 then sends (step 17 ) to the UICC a read command message of the file (or memory) containing the SUPI (Read EF_SUPI). Since the SUCI_ 1 and the parameter Param_ 1 are already present in this file, no computation of SUCI_ 1 is necessary and the security element 13 can immediately send to the terminal 12 SUCI_ 1 II Param_ 1 (step 18 ).
  • the terminal 12 then sends these received data in an Identity Response message to the element 11 (step 19 ).
  • the element 11 can decrypt SUCI_ 1 thanks to Param_ 1 in order to retrieve the SUPI.
  • the network has then identified the security element 13 .
  • the invention proposes to pre-calculate proactively at the occurrence of an event the encrypted identifier using a key and storing it in a file or memory of the security element 13 with a parameter enabling the key to be calculated by the element 11 of the telecommunications network in order to be able to transmit to this element 11 the encrypted identifier and the corresponding parameter, without having to compute the encrypted identifier when the terminal 12 is asking for it.
  • the computing time of 150 ms mentioned before is therefore gained because the encrypted identifier is ready for being read by the terminal.
  • the security element can then compute another SUCI (SUCI_ 2 ) and store SUCI_ 2 with Param_ 2 in the same file where previously SUCI_ 1 and Param_ 1 were stored. SUCI_ 2 and Param_ 2 are therefore ready to be sent at the next registration request sent from the terminal 12 to the network element 11 .
  • the network element 11 can be physical (a HSS or a AUSF for example) or virtual.
  • the security element 13 it is not the identifier SUPI associated to the security element 13 that is encrypted but an encrypted identifier of the terminal 12 .
  • the SUPI is then for example replaced by the IMEI of the terminal 12 . This is particularly valid when the security element is a eUICC, an iUICC or a hardware mediated execution environment (the security element is not extractable from the terminal).
  • the network element 11 has then a correspondence table associating the eID or the ICCID with the IMSI (SUPI) of the security element. This is also true when an encrypted IMEI is sent to the network element 11 .
  • an encrypted identifier of the security element like for example an encrypted eID or ICCID.
  • the network element 11 has then a correspondence table associating the eID or the ICCID with the IMSI (SUPI) of the security element. This is also true when an encrypted IMEI is sent to the network element 11 .
  • SUCI_ 2 is computed after having sent SUCI_ 1 II Param_ 1 to the terminal 12 .
  • This is a triggering event.
  • Other triggering events can cause the computing of a new SUCI (or more generally an encrypted identifier, this encrypted identifier being for example a SUCI, an encrypted identifier of the security element or an encrypted identifier of the terminal cooperating with this security element):
  • the security element is operational when leaving the personalization factory.
  • the SUPI is preferably encrypted by using an encryption mechanism like ECIES (Elliptic Curve Integrated Encryption Scheme). Such a mechanism is represented in FIG. 2 .
  • ECIES Elliptic Curve Integrated Encryption Scheme
  • the security element 13 generates an ephemeral key pair: An ephemeral private key and an ephemeral public key (for example in a module 30 ).
  • the ephemeral public key corresponds to Param_X mentioned above that will be sent along with the SUCI to the home network.
  • the ephemeral private key is sent to a crypto processor 31 of the security element 13 .
  • the crypto processor 31 also receives as another input the public key of the home network (HN Public Key).
  • the crypto processor 31 generates a key called ephemeral symmetric key that is transmitted to a symmetric encryption module 32 receiving also the SUPI of the security element 13 .
  • the symmetric encryption module 32 generates the SUCI containing the encrypted SUPI.
  • the SUCI and the ephemeral public key are then stored in a file or memory of the security element 13 .
  • the security element reads the IMEI of the terminal and realizes the same operations by using the IMEI instead of the SUPI.
  • the scheme is the same, and the SUPI is not used (only the MCC/MNC codes are not encrypted in order to connect to the home network of the security element).
  • FIG. 3 represents an example of decryption of the SUPI encrypted according to FIG. 2 .
  • the home network receives the SUCI and the ephemeral public key generated by the security element 13 .
  • the ephemeral public key is applied to a cryptographic module 40 receiving also the home network private key.
  • the ephemeral symmetric key is thus recovered and applied to symmetric decryption module 41 receiving also the received SUCI.
  • the symmetric decryption module 41 can then decrypt the SUCI for recovering the SUPI (or the IMEI or another identifier of the security element 13 ) and identify the security element 13 .
  • the SUCI is changed at each attachment procedure, if it is required by the network.
  • the mechanism of the invention can preferably be turned on/off by setting an OS flag and/or a service in the security element 13 service table (by OTA). This allows to adapt the system to each national regulation or lets the home network operator to choose if he wishes or not to implement the invention.
  • the invention also concerns a security element 13 comprising a processing circuit for pre-calculating an encrypted subscription identifier stored in the security element or an encrypted identifier of the security element or an encrypted identifier of a terminal designed to cooperate with this security element, the encrypted identifier being pre-calculated proactively at the occurrence of an event using a key and stored in a file or memory of the security element with a parameter enabling the key to be calculated by a physical or virtual element of the telecommunications network in order to be able to transmit to the element of the telecommunications network the encrypted identifier and the parameter, without having to compute the encrypted identifier when the terminal is asking for it.
  • the security element 13 preferably encrypts the identifier by using an ECIES encryption scheme.
  • the security element 13 can be a UICC, a eUICC, an iUICC or a hardware mediated execution environment.
  • the processing circuit can for example pre-calculate the encrypted identifier during one of the following events:
  • the processing circuit pre-calculates more than one encrypted identifiers and stores them with corresponding parameters in the file or memory.
  • the invention also concerns a physical or virtual element 11 of a telecommunications network comprising processing circuits for receiving from the security element 13 an identifier encrypted by a key pre-calculated by the security element 13 and stored in a file or memory of the security element 13 with a parameter enabling the key to be calculated by the element 11 of the telecommunications network.
  • the element of the telecommunication network identifying the security element is a HSS.
  • the element of the telecommunication network identifying the security element is a HSS.
  • it is an AUSF.
  • the invention concerns a terminal 12 cooperating with such a security element. It is for example constituted by a V2X terminal.
  • the terminal 12 (for example a mobile equipment) does not need to know the permanent identity of the mobile subscriber and this mechanism means that the permanent identity of the subscriber is protected at all times.
  • the terminal 12 will only ever have a dynamic and tokenized/surrogate value of the identifier of the security element 13 or of the terminal 12 which is usable for a given authentication.
  • the encrypted value is immediately available to the terminal 12 due to the pre-calculation of this encrypted value following a triggering event.
  • the processing to encrypt the identifier in the tamper resistant secure hardware element 13 does not add extra delay for the transmission of the encrypted identifier to the network element 11 .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
US16/753,465 2017-10-06 2018-10-02 Method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, corresponding security element, physical or virtual element and terminal cooperating with this security element Active 2039-06-27 US11528604B2 (en)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
EP17306349.6 2017-10-06
EP17306349.6A EP3468130A1 (de) 2017-10-06 2017-10-06 Verfahren zur übermittlung eines verschlüsselten identifizers, der in einem sicherheitselement enthalten ist, auf ein physisches oder virtuelles element eines telekommunikationsnetzes, entsprechendes sicherheitselement, physisches oder virtuelles element und terminal, das mit diesem sicherheitselement zusammenarbeitet.
EP17306349 2017-10-06
PCT/EP2018/076850 WO2019068731A1 (en) 2017-10-06 2018-10-02 METHOD FOR TRANSMITTING, TO A PHYSICAL OR VIRTUAL ELEMENT OF A TELECOMMUNICATIONS NETWORK, A PAID-TYPE SUBSCRIPTION IDENTIFIER STORED IN A SECURITY ELEMENT, SECURITY ELEMENT AND CORRESPONDING PHYSICAL OR VIRTUAL ELEMENT, AND TERMINAL COLLABORATING WITH SAID SECURITY ELEMENT

Publications (2)

Publication Number Publication Date
US20200260273A1 US20200260273A1 (en) 2020-08-13
US11528604B2 true US11528604B2 (en) 2022-12-13

Family

ID=60782113

Family Applications (1)

Application Number Title Priority Date Filing Date
US16/753,465 Active 2039-06-27 US11528604B2 (en) 2017-10-06 2018-10-02 Method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, corresponding security element, physical or virtual element and terminal cooperating with this security element

Country Status (5)

Country Link
US (1) US11528604B2 (de)
EP (2) EP3468130A1 (de)
JP (1) JP7139420B2 (de)
KR (1) KR102448747B1 (de)
WO (1) WO2019068731A1 (de)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220330017A1 (en) * 2021-04-09 2022-10-13 Stmicroelectronics S.R.L. Method for concealing a subscription identifier at a user equipment of a mobile communication network, and corresponding system and computer program product

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111866858A (zh) * 2019-04-29 2020-10-30 华为技术有限公司 一种注册方法及通信装置
US20200413253A1 (en) * 2019-06-26 2020-12-31 Qualcomm Incorporated Method and apparatus for enabling 5g services with pre-5g universal integrated circuit card (uicc)
CN112153626B (zh) * 2019-06-28 2022-04-26 中国移动通信有限公司研究院 服务发现的方法及网络设备
CN112866988B (zh) * 2019-11-13 2023-03-28 中国电信股份有限公司 终端的隐私保护方法和装置、终端
DE102021103996A1 (de) 2021-02-19 2022-08-25 Bundesdruckerei Gmbh Auslesen lokal gespeicherter verschlüsselter Identitätsattribute
DE102021004115A1 (de) 2021-08-10 2023-02-16 Giesecke+Devrient Mobile Security Gmbh Verfahren in einem secure element
WO2023025411A1 (de) * 2021-08-23 2023-03-02 Giesecke+Devrient Mobile Security Gmbh Verfahren in einem secure element
DE102022002276A1 (de) 2021-08-23 2023-02-23 Giesecke+Devrient Mobile Security Gmbh Verfahren in einem secure element
CN114173327A (zh) * 2021-12-06 2022-03-11 中国电信股份有限公司 基于5g行业专网的认证方法及终端

Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6373949B1 (en) 1997-04-16 2002-04-16 Nokia Networks Oy Method for user identity protection
US20030101345A1 (en) 2000-03-30 2003-05-29 Kaisa Nyberg Subscriber authentication
WO2005032170A2 (en) 2003-09-23 2005-04-07 Atc Technologies, Llc Systems and methods for mobility management in overlaid satellite and terrestrial communications systems
JP2006500842A (ja) 2002-09-26 2006-01-05 ジェムプリュス サーバへアクセスする端末の識別方法
US20140143826A1 (en) 2012-11-21 2014-05-22 Apple Inc. Policy-based techniques for managing access control
US20160112206A1 (en) * 2014-10-16 2016-04-21 Infineon Technologies North America Corp. System and Method for Vehicle Messaging Using a Public Key Infrastructure
EP3110189A1 (de) 2015-06-25 2016-12-28 Gemalto Sa Verfahren zum austauschen mindestens eines authentifizierungsparameters zur authentifizierung eines sicherheitselements und entsprechendes sicherheitselement
WO2017016889A1 (en) 2015-07-29 2017-02-02 Sony Corporation Communications devices and methods
WO2017072647A1 (en) 2015-10-27 2017-05-04 Fox Glacier Asset Management Llc Mobile payment system
WO2017152871A1 (en) 2016-03-10 2017-09-14 Huawei Technologies Co., Ltd. Authentication mechanism for 5g technologies
US20180324583A1 (en) * 2017-05-05 2018-11-08 Alcatel-Lucent Usa Inc. Identity request control for user equipment

Patent Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6373949B1 (en) 1997-04-16 2002-04-16 Nokia Networks Oy Method for user identity protection
US20030101345A1 (en) 2000-03-30 2003-05-29 Kaisa Nyberg Subscriber authentication
JP2006500842A (ja) 2002-09-26 2006-01-05 ジェムプリュス サーバへアクセスする端末の識別方法
US20060141987A1 (en) 2002-09-26 2006-06-29 Gemplus Identification of a terminal with a server
US20070293192A9 (en) 2002-09-26 2007-12-20 Gemplus Identification of a terminal to a server
WO2005032170A2 (en) 2003-09-23 2005-04-07 Atc Technologies, Llc Systems and methods for mobility management in overlaid satellite and terrestrial communications systems
US20140143826A1 (en) 2012-11-21 2014-05-22 Apple Inc. Policy-based techniques for managing access control
US20160112206A1 (en) * 2014-10-16 2016-04-21 Infineon Technologies North America Corp. System and Method for Vehicle Messaging Using a Public Key Infrastructure
EP3110189A1 (de) 2015-06-25 2016-12-28 Gemalto Sa Verfahren zum austauschen mindestens eines authentifizierungsparameters zur authentifizierung eines sicherheitselements und entsprechendes sicherheitselement
WO2017016889A1 (en) 2015-07-29 2017-02-02 Sony Corporation Communications devices and methods
WO2017072647A1 (en) 2015-10-27 2017-05-04 Fox Glacier Asset Management Llc Mobile payment system
WO2017152871A1 (en) 2016-03-10 2017-09-14 Huawei Technologies Co., Ltd. Authentication mechanism for 5g technologies
US20180324583A1 (en) * 2017-05-05 2018-11-08 Alcatel-Lucent Usa Inc. Identity request control for user equipment

Non-Patent Citations (6)

* Cited by examiner, † Cited by third party
Title
China Mobile, Thales, pCR Security enhancement to the attach procedure without relying on PKI [online], 3GPP TSG SA WG3 #85 S3-161775, Internet<URL:http://www.3gpp.org/ftp/tsg_saWG3_Security/TGS3_85_85_Santa_Cruz/Docs/S3-161775.zip.
English translation of Office Action mailed for co-pending Application in Japan N°2020-519423 dated Jan. 11, 2022 (18 pages).
International Search Report (PCT/ISA/210) dated Nov. 13, 2018, by the European Patent Office as the International Searching Authority for International Application No. PCT/EP2018/076850.
Office Action (Communication pursuant to Rule 94_3 EPC) for co-pending EP Application N°18783418.9, mailed by EPO dated Jan. 24, 2022 (6 pages).
Office Action (Notice of Reasons for Rejection) dated May 18, 2021, in corresponding Japanese Patent Application No. 2020-519423 and English translation of the Office Action. (7 pages).
Written Opinion (PCT/ISA/237) dated Nov. 13, 2020, by the European Patent Office as the International Searching Authority for International Application No. PCT/EP2018/076850.

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220330017A1 (en) * 2021-04-09 2022-10-13 Stmicroelectronics S.R.L. Method for concealing a subscription identifier at a user equipment of a mobile communication network, and corresponding system and computer program product

Also Published As

Publication number Publication date
EP3692697A1 (de) 2020-08-12
WO2019068731A1 (en) 2019-04-11
US20200260273A1 (en) 2020-08-13
KR102448747B1 (ko) 2022-09-29
EP3468130A1 (de) 2019-04-10
JP7139420B2 (ja) 2022-09-20
KR20200053609A (ko) 2020-05-18
JP2020536461A (ja) 2020-12-10

Similar Documents

Publication Publication Date Title
US11528604B2 (en) Method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, corresponding security element, physical or virtual element and terminal cooperating with this security element
US10931644B2 (en) Methods, network nodes, mobile entity, computer programs and computer program products for protecting privacy of a mobile entity
US9253178B2 (en) Method and apparatus for authenticating a communication device
US6243811B1 (en) Method for updating secret shared data in a wireless communication system
EP1873998B1 (de) Identifikatoren in einem kommunikationssystem
EP3485624B1 (de) Bedienung bezug auf benutzer ausrüstung mit geheim identifizierung
US20190289463A1 (en) Method and system for dual-network authentication of a communication device communicating with a server
EP3622736B1 (de) Datenschutzschlüssel in einem drahtloskommunikationssystem
CN110754101B (zh) 用于保护与用户设备相关联的订户信息的方法、系统和计算机可读存储介质
US11032699B2 (en) Privacy protection capabilities
EP3229398A1 (de) Verfahren zur aktualisierung eines langfristigen schlüssels zum schutz von kommunikationen zwischen einem netzwerk und einer entfernten vorrichtung
US20190082318A1 (en) Mobile equipment identity privacy, network node and methods thereof
KR20030015790A (ko) 이동 통신 시스템에서 가입자 정보 확인 방법
EP3836589A1 (de) Verfahren zur authentifizierung eines sicheren elements auf der ebene eines authentifizierungsservers, zugehöriges sicheres element und authentifizierungsserver
Zhang et al. Mitigating Signaling Storms in 5G with Blockchain-assisted 5GAKA
WO2020141561A1 (en) Method and system for transmission of secure information to a hand-held device
WO2014072293A1 (en) Secured authentication between a communication device and a server
Bluszcz UMTS Security UMTS Security

Legal Events

Date Code Title Description
FEPP Fee payment procedure

Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

AS Assignment

Owner name: GEMALTO SA, FRANCE

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BRADLEY, PAUL;REEL/FRAME:053699/0219

Effective date: 20180529

Owner name: THALES DIS FRANCE SA, FRANCE

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:PAULIAC, MIREILLE;REEL/FRAME:053699/0268

Effective date: 20200819

Owner name: THALES DIS FRANCE SA, FRANCE

Free format text: CHANGE OF NAME;ASSIGNOR:GEMALTO SA;REEL/FRAME:053707/0022

Effective date: 20190721

AS Assignment

Owner name: THALES DIS FRANCE SAS, FRANCE

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:THALES DIS FRANCE SA;REEL/FRAME:058884/0238

Effective date: 20211215

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED

STCF Information on status: patent grant

Free format text: PATENTED CASE